Obsidian Sandstorm LinkedIn Spearphishing Archive Execution via explorer.exe or WinRAR

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects the execution of suspicious file types (exe, dll, bat, cmd, vbs, js, ps1) originating from common extraction or user-writable locations like Downloads, Temp, or Roaming AppData directories. The rule specifically flags processes spawned by common archive utilities (winrar.exe, 7zFM.exe, 7zG.exe) or Windows Explorer, with an additional risk assessment if the command line arguments suggest recruitment or financial lure themes.